PT-2024-4006 · Unknown+5 · Cobalt Strike+5
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PHP versions 8.1 through 8.1.28
PHP versions 8.2 through 8.2.19
PHP versions 8.3 through 8.3.7
Description
An argument injection issue exists in the PHP CGI module on Windows when used with Apache. The flaw occurs because the Windows implementation does not account for "Best-Fit" behavior, where certain Unicode characters are converted to the closest matching ANSI characters during conversion to Win32 API functions. Attackers can send specially crafted HTTP requests containing specific character sequences (such as the soft hyphen
0xAD) that are misinterpreted as PHP options. This allows a remote attacker to pass arbitrary options to the PHP binary, potentially revealing script source code or achieving remote code execution (RCE).Real-world exploitation has been observed globally, including in the US, UK, Singapore, Indonesia, Taiwan, Hong Kong, India, Spain, Malaysia, and Japan. Attackers have used this flaw to deploy the Msupedge backdoor, Quasar RAT, and XMRig cryptocurrency miners. In some campaigns, tools like JuicyPotato and Cobalt Strike TaoWu plugins were used for privilege escalation and persistence. One reported campaign targeting developers resulted in 241,764 compromised accounts.
Recommendations
Update PHP to version 8.1.29.
Update PHP to version 8.2.20.
Update PHP to version 8.3.8.
As a temporary mitigation, avoid running PHP in CGI mode on Windows servers.
Exploit
Fix
LPE
DoS
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache
Cobalt Strike
Php
Red Os
Xampp